2 Way SSL - Client Certificate Not Sent To Server

ssl wireshark visualforce client-certificates force.com
Y.S picture Y.S · Jan 25, 2015 · Viewed 8.6k times · Source

I'm have an application deployed to salesforce on the force.com platform, which I'm trying to configure a 2 way SSL for.

I.e. I want that for each request sent to from SF to my server, a client certificate will be sent.

I did the necessary configurations on SF for the certificate to be sent, but I'm still getting 403.7 from the server, which means: forbidden, client certificate required.

I installed wireshark on the server, captured traffic to see the 2 way ssl handshake, and I'm trying to find in the server hello message where it tells the client the trusted CAs from which a client certificate should correspond, but I'm having difficulties finding it. I suspect that's why the client does not send the certificate.

Can anyone point me to where in the server hello I should look? Or perhaps in another packet capture?

Thanks in advance.

enter image description here

Client Key Exchange record:

enter image description here

Answer

Steffen Ullrich picture Steffen Ullrich · Jan 25, 2015

Added a screenshot of the handshake captures. can you please point me to where I should be looking? –

See packet #31. It contains the Certificate Request. Also packet #33 contains the certificate from the client, so the reason is not the client does not send the certificate, but instead that the server either does not like the certificate because the validation failed or because the certificate is not sufficient as authorization for the requested resource. You might get more information from the servers log.

Related questions

Chrome not Firefox are not dumping to SSLKEYLOGFILE variable

I'm trying to decrypt SSL packages with Wireshark as described here. I have already created a SSLKEYLOGFILE System and User variable and the log file. I have restarted my computer (running Windows 10), and opened https urls with Chrome and Firefox, …

Read More
Decrypting HTTPS traffic in Wireshark not working

I'm running Wireshark 1.8.6 on Windows Server 2008 R2 and attempting to decrypt incoming HTTPS communication in order to debug an issue I'm seeing. I have my RSA Keys list set up correctly (I think) but Wireshark will not decrypt the SSL …

Read More
How do you decrypt SSH .pcap file that uses Diffie Hellman encryption. With public and private keys

How do you decrypt SSH .pcap file that uses Diffie Hellman encryption. With public and private keys. We are trying through Wireshark with no luck.

Read More